Can My Prime Look Up My CMMC Level 1 Status in SPRS?

Short Answer

DoD has said primes are not granted access to a subcontractor's information in SPRS. A company can view its own status in SPRS, and the DoW CIO CMMC FAQs say suppliers may print verification of their status to share with their primes. The prime still has a duty under DFARS 252.204-7021 to ensure, before subcontract award, that you hold a current CMMC status at the level the information requires. Sharing that proof is a step between you and your prime.

Why the Confusion Exists

The prime contract clause tells the prime to make sure each subcontractor has a current CMMC status before award. It is natural to assume the prime checks that the same way the Contracting Officer does, by looking it up in SPRS.

The Contracting Officer does check SPRS. Under DFARS 204.7503(b), the Contracting Officer verifies each offeror's status in SPRS using the UIDs the offeror provides. That path belongs to the government, not to other companies.

What the Current Authority Says

Under 32 CFR 170.23(a), CMMC requirements apply to subcontractors at all tiers that will process, store, or transmit FCI or CUI in performance of the subcontract. A subcontractor that will handle only FCI needs a CMMC Status of Level 1 (Self).

DFARS 252.204-7021(d)(1)(ii) requires the prime to flow down the correct CMMC level. Under (d)(4), the prime must ensure that subcontractors and suppliers complete, before subcontract award and annually after that, an affirmation of continuous compliance for their systems that handle FCI or CUI. Under (f)(2), before awarding a subcontract, the prime must ensure that the subcontractor has a current CMMC status at the level appropriate for the information flowed down.

In the preamble to the CMMC final rule, DoD states that it does not provide SPRS access or other tools for contractors to identify the CMMC status of other companies, and that prime contractors will not be granted access to a subcontractor's information in SPRS. It says primes should communicate early and often with prospective subcontractors to confirm current CMMC status, and that this interaction does not involve the government (89 FR 83117).

The DoW CIO CMMC FAQs of July 2026 (C-A4) say the public has no access to a listing of companies that have completed CMMC self-assessments, that a company can view its own status in SPRS, and that suppliers may print verification of their status from SPRS to share with their primes. The FAQs add that the Department expects contractors to share CMMC status information with each other to support teaming.

What This Means

Expect your prime to ask you for proof of your status. One way the FAQs name is a verification you print from SPRS, which shows your own status as SPRS records it.

Check the dates before you share it. Under DFARS 252.204-7021, a Final Level 1 (Self) status is current only when it is not older than one year and its affirmation is not older than one year.

The prime's duty to confirm your status does not move your own obligations to the prime. Under 32 CFR 170.22, the Affirming Official of each organization, prime or subcontractor, affirms its own compliance. Your self-assessment, your SPRS entry, and your affirmation are still yours to complete.